coolhand-cli 0.10.0 → 0.11.0

package/dist/commands/sync-skills.d.ts

@@ -0,0 +1,18 @@
+import { type SkillRoot } from '../skills/skill-scanner.js';
+import type { SyncSkillsOptions } from '../types.js';
+export interface SyncSkillsDeps {
+    /** Overrides `os.homedir()` for the `authored` and `claude-code` default roots only. The
+     *  `installed` root always comes from the canonical `defaultCoworkSessionsDir()` (reused as-is
+     *  from cowork-scanner.ts, deliberately not re-derived here to avoid drift) — that function has
+     *  no override parameter of its own and always reads the real `os.homedir()`, so it does NOT
+     *  move with this override. Note that mutating `process.env.HOME` in a test is not a substitute
+     *  for this: Node's `os.homedir()` native binding does not reliably observe a `HOME` mutated
+     *  after process start under Jest, which is why this injection point exists at all. */
+    homedir?: () => string;
+    /** Override the roots to scan, bypassing the default 3-root/--root/--source resolution
+     *  entirely (including the `installed` root) — used by tests that need every root, including
+     *  `installed`, pointed at a temp directory. */
+    roots?: SkillRoot[];
+}
+export declare function run(opts: SyncSkillsOptions, deps?: SyncSkillsDeps): Promise<number>;
+//# sourceMappingURL=sync-skills.d.ts.map

package/dist/commands/sync-skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-skills.d.ts","sourceRoot":"","sources":["../../src/commands/sync-skills.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B;;;;;;2FAMuF;IACvF,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB;;oDAEgD;IAChD,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;CACrB;AAqED,wBAAsB,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4J7F"}

package/dist/commands/sync-skills.js

@@ -0,0 +1,222 @@
+import * as os from 'os';
+import * as path from 'path';
+import { CliError, ExitCode } from '../errors.js';
+import { logger, redact } from '../logger.js';
+import { loadConfig, resolveClientForDryRun } from '../config.js';
+import { uploadClientFile } from '../upload-client-file.js';
+import { defaultCoworkSessionsDir } from '../sessions/cowork-scanner.js';
+import { sanitizeProjectKey } from '../sessions/session-filter.js';
+import { findSkillFiles, dedupeSkillFiles, } from '../skills/skill-scanner.js';
+import { loadSkillState, getUploadRecord, recordUpload, saveSkillState } from '../skills/skill-state.js';
+/** Errors that apply to every candidate (auth/config), so the run should abort rather than fail
+ *  identically for each remaining upload. Deliberately narrower than analyze-claude-sessions'
+ *  FATAL_CODES: INVALID_ARGS from uploadClientFile here is a per-FILE condition (unreadable file,
+ *  over the size cap) that can easily succeed for the next candidate, so it must NOT be fatal —
+ *  unlike analyze-claude-sessions, where INVALID_ARGS comes from a malformed envelope shape that
+ *  would fail identically for every session. NO_PRIVATE_KEY, absent from analyze-claude-sessions'
+ *  set (logRequest uses the public-key tier), is fatal here because uploadClientFile always
+ *  requires a private key — identical for every candidate, so retrying per-item is pointless. */
+const FATAL_CODES = new Set(['NOT_CONFIGURED', 'CLIENT_NOT_FOUND', 'INVALID_BASE_URL', 'NO_PRIVATE_KEY']);
+const VALID_SOURCE_KINDS = ['authored', 'installed', 'claude-code'];
+function defaultRoots(homedir) {
+    return [
+        { root: path.join(homedir(), 'Documents', 'Claude'), sourceKind: 'authored' },
+        { root: defaultCoworkSessionsDir(), sourceKind: 'installed' },
+        { root: path.join(homedir(), '.claude', 'skills'), sourceKind: 'claude-code' },
+    ];
+}
+function resolveRoots(opts, homedir) {
+    if (opts.root) {
+        return [{ root: opts.root, sourceKind: 'custom' }];
+    }
+    const roots = defaultRoots(homedir);
+    if (!opts.sources || opts.sources.length === 0) {
+        return roots;
+    }
+    const wanted = new Set(opts.sources.map((s) => s.toLowerCase()));
+    for (const s of wanted) {
+        if (!VALID_SOURCE_KINDS.includes(s)) {
+            throw new CliError('INVALID_ARGS', `--source must be one of: ${VALID_SOURCE_KINDS.join(', ')} (got "${s}")`);
+        }
+    }
+    return roots.filter((r) => wanted.has(r.sourceKind));
+}
+/** Substring/case-insensitive match on skill name, using the same normalization
+ *  (`sanitizeProjectKey`) as --project/--exclude-project so filter semantics stay consistent
+ *  across commands. */
+function matchesFilter(skillName, needles) {
+    const key = sanitizeProjectKey(skillName);
+    return needles.some((needle) => key.includes(sanitizeProjectKey(needle)));
+}
+function applyNameFilters(candidates, opts) {
+    let result = candidates;
+    const includeNeedles = opts.skills;
+    if (includeNeedles && includeNeedles.length > 0) {
+        result = result.filter((c) => matchesFilter(c.skillName, includeNeedles));
+    }
+    const excludeNeedles = opts.excludeSkills;
+    if (excludeNeedles && excludeNeedles.length > 0) {
+        result = result.filter((c) => !matchesFilter(c.skillName, excludeNeedles));
+    }
+    return result;
+}
+function describeCandidate(candidate) {
+    if (candidate.description) {
+        return candidate.description;
+    }
+    const extraCopies = candidate.duplicateCount - 1;
+    const copiesNote = extraCopies > 0 ? `, ${extraCopies} duplicate cop${extraCopies === 1 ? 'y' : 'ies'} found on this machine` : '';
+    return `Claude skill "${candidate.skillName}" (source: ${candidate.sourceKind}${copiesNote})`;
+}
+export async function run(opts, deps = {}) {
+    try {
+        const cfg = await loadConfig();
+        const client = await resolveClientForDryRun(cfg, opts.clientId);
+        const stateClientId = client?.client_id ?? '_default';
+        // Pass the already-resolved client_id downstream (not opts.clientId) so each per-skill
+        // uploadClientFile() call takes the fast "explicit clientId" branch of its own internal
+        // resolveClientForDryRun/resolveClient call instead of re-running the full priority chain —
+        // in particular, never re-prompting interactively over a TTY once per skill upload. That
+        // inner call still re-reads config.json and re-prints "Client: <name> (<id>)" to stderr once
+        // per upload (resolveClient always does, with no silent/quiet option) — a known, accepted
+        // cost of reusing uploadClientFile()'s shared core as-is rather than duplicating its
+        // auth/dry-run/size-cap logic in a separate lower-level upload path.
+        const resolvedClientId = client?.client_id;
+        // Fail fast on a fully logged-out, non-dry-run invocation — mirrors the same guard inside
+        // uploadClientFile() itself, but checked here too so a real run doesn't waste time scanning
+        // and SHA-256-hashing every SKILL.md across all default roots only to fail on the very first
+        // upload attempt.
+        if (!client && !opts.dryRun) {
+            throw new CliError('NOT_CONFIGURED', 'Not logged in. Run `coolhand login` to authenticate.');
+        }
+        const roots = deps.roots ?? resolveRoots(opts, deps.homedir ?? os.homedir);
+        // Captured once, before the scan, so every candidate uploaded from this run reports the same
+        // discoveredAt — stamping it per-candidate inside the upload loop instead would both misname
+        // the field (it'd reflect upload time, not discovery time) and drift across a large batch.
+        const discoveredAt = new Date().toISOString();
+        const warnings = [];
+        const discovered = await findSkillFiles(roots, (message) => warnings.push(message));
+        for (const message of warnings) {
+            logger.warn(message);
+        }
+        const allCandidates = dedupeSkillFiles(discovered);
+        const candidates = applyNameFilters(allCandidates, opts);
+        const duplicatesSkipped = discovered.length - allCandidates.length;
+        const filteredOut = allCandidates.length - candidates.length;
+        const state = await loadSkillState();
+        const toUpload = [];
+        let unchangedCount = 0;
+        for (const candidate of candidates) {
+            // The state key already embeds contentHash (see skill-state.ts's stateKey), so a hit here
+            // means this exact content was already uploaded under this name — no separate hash
+            // comparison needed.
+            const record = getUploadRecord(state, stateClientId, candidate.skillName, candidate.contentHash);
+            if (record && !opts.force) {
+                unchangedCount += 1;
+            }
+            else {
+                toUpload.push(candidate);
+            }
+        }
+        if (opts.dryRun) {
+            if (opts.json) {
+                logger.json({
+                    ok: true,
+                    dryRun: true,
+                    found: discovered.length,
+                    duplicatesSkipped,
+                    filteredOut,
+                    new: toUpload.length,
+                    unchanged: unchangedCount,
+                });
+            }
+            else {
+                logger.info(`Dry run: found ${discovered.length} skill file(s), ${duplicatesSkipped} duplicate(s) skipped` +
+                    (filteredOut > 0 ? `, ${filteredOut} filtered out` : '') +
+                    ` — would upload ${toUpload.length}, ${unchangedCount} unchanged. Nothing sent.`);
+            }
+            return ExitCode.OK;
+        }
+        let uploaded = 0;
+        let failed = 0;
+        try {
+            for (const candidate of toUpload) {
+                try {
+                    const result = await uploadClientFile({
+                        filePath: candidate.filePath,
+                        name: candidate.skillName,
+                        fileType: 'document',
+                        description: describeCandidate(candidate),
+                        metadata: {
+                            source: 'sync-skills',
+                            skillName: candidate.skillName,
+                            sourceKind: candidate.sourceKind,
+                            sourcePath: candidate.filePath,
+                            contentHash: candidate.contentHash,
+                            discoveredAt,
+                            duplicateCount: candidate.duplicateCount,
+                            root: candidate.root,
+                        },
+                    }, 
+                    // dryRun is deliberately omitted here (unlike map-claude-projects' single call) —
+                    // this loop is only ever reached after the opts.dryRun early-return above, so it
+                    // would always be false; sync-skills has its own independent dry-run short-circuit.
+                    { clientId: resolvedClientId });
+                    recordUpload(state, stateClientId, candidate.skillName, candidate.contentHash, {
+                        contentHash: candidate.contentHash,
+                        uploadedAt: new Date().toISOString(),
+                        ...(result.response?.id && { clientFileId: result.response.id }),
+                    });
+                    uploaded += 1;
+                }
+                catch (err) {
+                    if (err instanceof CliError && FATAL_CODES.has(err.code)) {
+                        throw err;
+                    }
+                    failed += 1;
+                    logger.warn(`Failed to upload skill "${candidate.skillName}": ${redact(err.message)}`);
+                }
+            }
+        }
+        finally {
+            try {
+                await saveSkillState(state);
+            }
+            catch (err) {
+                logger.warn(`Failed to save skill state: ${redact(err.message)}`);
+            }
+        }
+        if (opts.json) {
+            logger.json({
+                ok: failed === 0,
+                found: discovered.length,
+                duplicatesSkipped,
+                filteredOut,
+                uploaded,
+                unchanged: unchangedCount,
+                failed,
+            });
+        }
+        else {
+            const failureNote = failed > 0 ? `, ${failed} failed` : '';
+            logger.info(`Uploaded ${uploaded} skill(s), ${unchangedCount} unchanged` +
+                (duplicatesSkipped > 0 ? `, ${duplicatesSkipped} duplicate(s) skipped` : '') +
+                (filteredOut > 0 ? `, ${filteredOut} filtered out` : '') +
+                `${failureNote}.`);
+        }
+        return failed === 0 ? ExitCode.OK : ExitCode.USER_ERROR;
+    }
+    catch (err) {
+        if (err instanceof CliError) {
+            if (opts.json) {
+                logger.json({ ok: false, error: err.code, message: redact(err.message) });
+            }
+            else {
+                logger.info(`Error: ${redact(err.message)} [${err.code}]`);
+            }
+            return err.exitCode;
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=sync-skills.js.map

package/dist/commands/sync-skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-skills.js","sourceRoot":"","sources":["../../src/commands/sync-skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EACL,cAAc,EACd,gBAAgB,GAIjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAkBzG;;;;;;;iGAOiG;AACjG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE1G,MAAM,kBAAkB,GAAsB,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEvF,SAAS,YAAY,CAAC,OAAqB;IACzC,OAAO;QACL,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QAC7E,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;QAC7D,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE;KAC/E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAuB,EAAE,OAAqB;IAClE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAoB,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,4BAA4B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;uBAEuB;AACvB,SAAS,aAAa,CAAC,SAAiB,EAAE,OAAiB;IACzD,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA4B,EAAE,IAAuB;IAC7E,IAAI,MAAM,GAAG,UAAU,CAAC;IACxB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;IAC1C,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAyB;IAClD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC,WAAW,CAAC;IAC/B,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,iBAAiB,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACnI,OAAO,iBAAiB,SAAS,CAAC,SAAS,cAAc,SAAS,CAAC,UAAU,GAAG,UAAU,GAAG,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB,EAAE,OAAuB,EAAE;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,MAAM,EAAE,SAAS,IAAI,UAAU,CAAC;QACtD,uFAAuF;QACvF,wFAAwF;QACxF,4FAA4F;QAC5F,yFAAyF;QACzF,6FAA6F;QAC7F,0FAA0F;QAC1F,qFAAqF;QACrF,qEAAqE;QACrE,MAAM,gBAAgB,GAAG,MAAM,EAAE,SAAS,CAAC;QAC3C,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,kBAAkB;QAClB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3E,6FAA6F;QAC7F,6FAA6F;QAC7F,2FAA2F;QAC3F,MAAM,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QACnE,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAE7D,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QAErC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,0FAA0F;YAC1F,mFAAmF;YACnF,qBAAqB;YACrB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;YACjG,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC1B,cAAc,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,IAAI;oBACZ,KAAK,EAAE,UAAU,CAAC,MAAM;oBACxB,iBAAiB;oBACjB,WAAW;oBACX,GAAG,EAAE,QAAQ,CAAC,MAAM;oBACpB,SAAS,EAAE,cAAc;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,kBAAkB,UAAU,CAAC,MAAM,mBAAmB,iBAAiB,uBAAuB;oBAC5F,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,mBAAmB,QAAQ,CAAC,MAAM,KAAK,cAAc,2BAA2B,CACnF,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,EAAE,CAAC;QACrB,CAAC;QAED,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,CAAC;YACH,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC;wBACE,QAAQ,EAAE,SAAS,CAAC,QAAQ;wBAC5B,IAAI,EAAE,SAAS,CAAC,SAAS;wBACzB,QAAQ,EAAE,UAAU;wBACpB,WAAW,EAAE,iBAAiB,CAAC,SAAS,CAAC;wBACzC,QAAQ,EAAE;4BACR,MAAM,EAAE,aAAa;4BACrB,SAAS,EAAE,SAAS,CAAC,SAAS;4BAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;4BAChC,UAAU,EAAE,SAAS,CAAC,QAAQ;4BAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;4BAClC,YAAY;4BACZ,cAAc,EAAE,SAAS,CAAC,cAAc;4BACxC,IAAI,EAAE,SAAS,CAAC,IAAI;yBACrB;qBACF;oBACD,kFAAkF;oBAClF,iFAAiF;oBACjF,oFAAoF;oBACpF,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAC/B,CAAC;oBACF,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;wBAC7E,WAAW,EAAE,SAAS,CAAC,WAAW;wBAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACpC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;qBACjE,CAAC,CAAC;oBACH,QAAQ,IAAI,CAAC,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzD,MAAM,GAAG,CAAC;oBACZ,CAAC;oBACD,MAAM,IAAI,CAAC,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,2BAA2B,SAAS,CAAC,SAAS,MAAM,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,+BAA+B,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,MAAM,KAAK,CAAC;gBAChB,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,iBAAiB;gBACjB,WAAW;gBACX,QAAQ;gBACR,SAAS,EAAE,cAAc;gBACzB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CACT,YAAY,QAAQ,cAAc,cAAc,YAAY;gBAC1D,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,iBAAiB,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,WAAW,GAAG,CACpB,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -4,7 +4,7 @@ export declare enum ExitCode {
     INTERNAL = 2,
     ABORTED = 130
 }
-export type ErrorCode = 'TIMEOUT' | 'STATE_MISMATCH' | 'INVALID_CALLBACK' | 'BROWSER_FAILED' | 'CONFIG_WRITE_FAILED' | 'CONFIG_READ_FAILED' | 'NOT_CONFIGURED' | 'INVALID_REDIRECT_URI' | 'INVALID_BASE_URL' | 'INVALID_ARGS' | 'WRITE_ENV_FAILED' | 'CLIENT_NOT_FOUND' | 'NO_PRIVATE_KEY' | 'MCP_ERROR' | 'INGEST_ERROR' | 'FEEDBACK_ERROR' | 'LOG_ERROR' | 'CERT_FILE_INSECURE' | 'UPLOAD_ERROR';
+export type ErrorCode = 'TIMEOUT' | 'STATE_MISMATCH' | 'INVALID_CALLBACK' | 'BROWSER_FAILED' | 'CONFIG_WRITE_FAILED' | 'CONFIG_READ_FAILED' | 'NOT_CONFIGURED' | 'INVALID_REDIRECT_URI' | 'INVALID_BASE_URL' | 'INVALID_ARGS' | 'WRITE_ENV_FAILED' | 'CLIENT_NOT_FOUND' | 'NO_PRIVATE_KEY' | 'MCP_ERROR' | 'INGEST_ERROR' | 'FEEDBACK_ERROR' | 'LOG_ERROR' | 'TEMPLATE_ERROR' | 'LLM_REFERENCE_ERROR' | 'CERT_FILE_INSECURE' | 'UPLOAD_ERROR' | 'OUTPUT_EXISTS';
 export declare class CliError extends Error {
     readonly code: ErrorCode;
     readonly exitCode: number;

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,oBAAY,QAAQ;IAClB,EAAE,IAAI;IACN,UAAU,IAAI;IACd,QAAQ,IAAI;IACZ,OAAO,MAAM;CACd;AAED,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,GACpB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,GAClB,cAAc,GACd,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,cAAc,CAAC;AAEnB,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,QAAQ,EAAE,MAAM,CAAC;gBAErB,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B;CAMrF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,oBAAY,QAAQ;IAClB,EAAE,IAAI;IACN,UAAU,IAAI;IACd,QAAQ,IAAI;IACZ,OAAO,MAAM;CACd;AAED,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,GACpB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,GAClB,cAAc,GACd,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,WAAW,GACX,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,GACpB,cAAc,GACd,eAAe,CAAC;AAEpB,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,QAAQ,EAAE,MAAM,CAAC;gBAErB,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B;CAMrF"}

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,QAKX;AALD,WAAY,QAAQ;IAClB,mCAAM,CAAA;IACN,mDAAc,CAAA;IACd,+CAAY,CAAA;IACZ,+CAAa,CAAA;AACf,CAAC,EALW,QAAQ,KAAR,QAAQ,QAKnB;AAuBD,MAAM,OAAO,QAAS,SAAQ,KAAK;IAIjC,YAAY,IAAe,EAAE,OAAe,EAAE,WAAmB,QAAQ,CAAC,UAAU;QAClF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,QAKX;AALD,WAAY,QAAQ;IAClB,mCAAM,CAAA;IACN,mDAAc,CAAA;IACd,+CAAY,CAAA;IACZ,+CAAa,CAAA;AACf,CAAC,EALW,QAAQ,KAAR,QAAQ,QAKnB;AA0BD,MAAM,OAAO,QAAS,SAAQ,KAAK;IAIjC,YAAY,IAAe,EAAE,OAAe,EAAE,WAAmB,QAAQ,CAAC,UAAU;QAClF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF"}

package/dist/proxy/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy/proxy.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAWD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC,CA+GxB"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy/proxy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAwEhD,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAeD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC,CA+GxB"}

package/dist/proxy/proxy.js

@@ -1,6 +1,74 @@
+import * as net from "node:net";
 import * as mockttp from "mockttp";
 import { shouldCapture, sanitizeHeaders, sanitizeURL, flattenHeaders } from "./interceptor.js";
 import { sendToCoolhand } from "./sender.js";
+import { redactSecrets } from "../sessions/redact-secrets.js";
+const LOOPBACK = "127.0.0.1";
+/**
+ * mockttp has no host/bind-address option anywhere in its public API (checked
+ * every published 4.x release, including latest) — Mockttp#start(port) always
+ * calls its internal combo server's .listen(port) with no host, which binds
+ * the wildcard address and turns this MITM proxy into an unauthenticated open
+ * forward proxy reachable from the local network (coolhand-cli#119).
+ *
+ * mockttp's combo server is built via httpolyglot, whose `Server` class
+ * `extends net.Server` without overriding `listen()`, so it inherits
+ * `net.Server.prototype.listen` directly — same as http.Server/https.Server.
+ * We exploit that to force a real loopback bind, identical in effect to
+ * callback-server.ts's own `server.listen(0, LOOPBACK, ...)`, by scope-patching
+ * the prototype for the exact duration of the start() call. Do not remove this
+ * without confirming upstream mockttp has added a real host option.
+ */
+// Guards against two overlapping startMockttpOnLoopback() calls stepping on
+// each other's prototype patch — startProxy() only ever runs once per CLI
+// process, so this should never trip in practice; it exists so a future
+// concurrent caller fails loudly instead of silently reverting to a wildcard
+// bind for whichever call restores the prototype first.
+let patchInFlight = false;
+async function startMockttpOnLoopback(server, port) {
+    if (patchInFlight) {
+        throw new Error("[coolhand-proxy] a proxy is already starting — concurrent startProxy() calls are not supported");
+    }
+    patchInFlight = true;
+    const originalListen = net.Server.prototype.listen;
+    net.Server.prototype.listen = function (...args) {
+        // Only the (port[, callback]) shape needs a host injected — leave any
+        // other call shape (e.g. one that already specifies a host) untouched.
+        if (typeof args[0] === "number" && (args.length === 1 || typeof args[1] === "function")) {
+            args.splice(1, 0, LOOPBACK);
+        }
+        return originalListen.apply(this, args);
+    };
+    try {
+        await server.start(port ?? 0);
+    }
+    finally {
+        net.Server.prototype.listen = originalListen;
+        patchInFlight = false;
+    }
+    // Defense in depth: if a future mockttp release changes its internals such
+    // that the patch above silently no-ops, fail loudly here rather than run an
+    // open proxy unnoticed. Verification itself is best-effort — if it can't
+    // determine the bound host (e.g. the private field was renamed), skip the
+    // check rather than fail the whole command over an inability to double-check.
+    let boundHost;
+    try {
+        const internal = server.server;
+        const address = internal?.address();
+        boundHost = address && typeof address === "object" ? address.address : undefined;
+    }
+    catch {
+        return;
+    }
+    if (boundHost !== undefined && boundHost !== LOOPBACK) {
+        await server.stop().catch(() => undefined);
+        throw new Error(`[coolhand-proxy] refused to start: proxy bound to ${boundHost}, expected ${LOOPBACK}. ` +
+            `This likely means mockttp's internals changed in a way that broke the loopback-only fix — see coolhand-cli#119.`);
+    }
+}
+function redactBodyText(text) {
+    return text === undefined ? undefined : redactSecrets(text);
+}
 /**
  * Start an HTTPS MITM proxy that intercepts LLM API calls
  * and forwards them to the Coolhand platform.
@@ -58,12 +126,12 @@ export async function startProxy(ca, options) {
                     method: req.method,
                     url: sanitizedUrl,
                     headers: sanitizeHeaders(req.headers),
-                    body: requestBodyText,
+                    body: redactBodyText(requestBodyText),
                 },
                 response: {
                     statusCode: res.statusCode,
                     headers: sanitizeHeaders(flattenHeaders(res.headers)),
-                    body: responseBodyText,
+                    body: redactBodyText(responseBodyText),
                 },
                 timestamp: req.timestamp,
             };
@@ -86,7 +154,7 @@ export async function startProxy(ca, options) {
     });
     // Pass all requests through to their real destinations
     await server.forAnyRequest().thenPassThrough();
-    await server.start(options.port ?? 0);
+    await startMockttpOnLoopback(server, options.port);
     const port = server.port;
     if (!options.silent) {
         console.error(`[coolhand-proxy] Proxy started on port ${port}`);

package/dist/proxy/proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/proxy/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,cAAc,EAA4B,MAAM,aAAa,CAAC;AA2BvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAiB,EACjB,OAAqB;IAErB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9B,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;KACtC,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1D,+EAA+E;IAC/E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE/C,MAAM,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAqB,EAAE,EAAE;QACnD,gFAAgF;QAChF,gFAAgF;QAChF,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACzB,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,OAAwD,CAAC;YACrF,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7D,cAAc,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,IAAI,WAAW,CAAC,GAAG,EAAE;YACrE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAmB,EAAE,EAAE;QAC/C,sEAAsE;QACtE,uEAAuE;QACvE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAsB,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACrB,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE/B,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,EAAE,qBAAqB,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;QAClF,MAAM,UAAU,GAAG,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC;QAErD,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,EAAE;YAC3G,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAwB;gBACpC,OAAO,EAAE;oBACP,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,EAAE,YAAY;oBACjB,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;oBACrC,IAAI,EAAE,eAAe;iBACtB;gBACD,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,OAAwD,CAAC,CAAC;oBACtG,IAAI,EAAE,gBAAgB;iBACvB;gBACD,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;YAEF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,6BAA6B,GAAG,CAAC,MAAM,IAAI,YAAY,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAC7G,CAAC;YACJ,CAAC;YAED,OAAO,cAAc,CAAC,QAAQ,EAAE;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,sEAAsE;YACtE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAM,CAAC;YAC1C,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;gBAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/proxy/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,cAAc,EAA4B,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,MAAM,QAAQ,GAAG,WAAW,CAAC;AAE7B;;;;;;;;;;;;;;GAcG;AACH,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AACxE,6EAA6E;AAC7E,wDAAwD;AACxD,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,KAAK,UAAU,sBAAsB,CAAC,MAAe,EAAE,IAAwB;IAC7E,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACpH,CAAC;IACD,aAAa,GAAG,IAAI,CAAC;IAErB,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACnD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,UAA4B,GAAG,IAAe;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;YACxF,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAyC,CAAC,CAAC;IAC/E,CAA0B,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,cAAc,CAAC;QAC7C,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,8EAA8E;IAC9E,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAI,MAA6C,CAAC,MAAM,CAAC;QACvE,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpC,SAAS,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,qDAAqD,SAAS,cAAc,QAAQ,IAAI;YACxF,iHAAiH,CAClH,CAAC;IACJ,CAAC;AACH,CAAC;AA0BD,SAAS,cAAc,CAAC,IAAwB;IAC9C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAiB,EACjB,OAAqB;IAErB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9B,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;KACtC,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1D,+EAA+E;IAC/E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE/C,MAAM,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAqB,EAAE,EAAE;QACnD,gFAAgF;QAChF,gFAAgF;QAChF,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACzB,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,OAAwD,CAAC;YACrF,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7D,cAAc,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,IAAI,WAAW,CAAC,GAAG,EAAE;YACrE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAmB,EAAE,EAAE;QAC/C,sEAAsE;QACtE,uEAAuE;QACvE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAsB,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACrB,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE/B,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,EAAE,qBAAqB,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;QAClF,MAAM,UAAU,GAAG,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC;QAErD,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,EAAE;YAC3G,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAwB;gBACpC,OAAO,EAAE;oBACP,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,EAAE,YAAY;oBACjB,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;oBACrC,IAAI,EAAE,cAAc,CAAC,eAAe,CAAC;iBACtC;gBACD,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,OAAwD,CAAC,CAAC;oBACtG,IAAI,EAAE,cAAc,CAAC,gBAAgB,CAAC;iBACvC;gBACD,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;YAEF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,6BAA6B,GAAG,CAAC,MAAM,IAAI,YAAY,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAC7G,CAAC;YACJ,CAAC;YAED,OAAO,cAAc,CAAC,QAAQ,EAAE;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,sEAAsE;YACtE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAM,CAAC;YAC1C,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;gBAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/proxy/wrap-runner.d.ts

@@ -1,15 +1,12 @@
 import { spawn } from 'child_process';
 import { startProxy, type ProxyInstance } from './proxy.js';
 import { getOrCreateCA } from './certs.js';
+import { resolveWrapSpawn } from '../win-spawn.js';
+export { resolveWrapSpawn };
 export interface WrapDeps {
     spawnFn?: typeof spawn;
     startProxyFn?: (ca: Awaited<ReturnType<typeof getOrCreateCA>>, opts: Parameters<typeof startProxy>[1]) => Promise<ProxyInstance>;
 }
-export declare function resolveWrapSpawn(cmd: string, args: string[], platform?: NodeJS.Platform): {
-    cmd: string;
-    spawnArgs: string[];
-    windowsVerbatimArguments?: true;
-};
 /**
  * Build the full ingest endpoint for a given client's base_url.
  * The CLI stores only the site base_url, so append the ingest path here.

package/dist/proxy/wrap-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrap-runner.d.ts","sourceRoot":"","sources":["../../src/proxy/wrap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAMtC,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAe,MAAM,YAAY,CAAC;AAGxD,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAClI;AAsBD,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,QAAQ,kBAAmB,GAC1B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,wBAAwB,CAAC,EAAE,IAAI,CAAA;CAAE,CAWvE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBtE;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CA4FjB"}
+{"version":3,"file":"wrap-runner.d.ts","sourceRoot":"","sources":["../../src/proxy/wrap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAMtC,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAe,MAAM,YAAY,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAClI;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBtE;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CA4FjB"}

package/dist/proxy/wrap-runner.js

@@ -7,37 +7,8 @@ import { DEFAULT_BASE_URL } from '../types.js';
 import { startProxy } from './proxy.js';
 import { getOrCreateCA, getCertPath } from './certs.js';
 import { PACKAGE_IDENTIFIER } from '../version.js';
-/**
- * On Windows, .cmd shims cannot be spawned without a shell. Rather than using
- * shell:true (which forwards args as an unquoted string to cmd.exe, enabling
- * metacharacter injection), we invoke cmd.exe /d /s /c directly with the command
- * and each arg double-quoted and windowsVerbatimArguments:true so Node does not
- * re-quote them.
- *
- * Quoting rules applied to the command and every arg:
- *   1. Double trailing backslashes (a trailing \ would escape the closing ")
- *   2. Escape embedded " as ""
- *   3. Escape % as %% to prevent cmd.exe environment-variable expansion
- *   4. Wrap in double quotes unconditionally
- */
-function escapeForCmdExe(s) {
-    return s
-        .replace(/(\\+)$/, '$1$1') // double trailing backslashes
-        .replace(/"/g, '""') // escape embedded quotes
-        .replace(/%/g, '%%'); // prevent env-var expansion
-}
-export function resolveWrapSpawn(cmd, args, platform = process.platform) {
-    if (platform !== 'win32') {
-        return { cmd, spawnArgs: args };
-    }
-    const escapedCmd = `"${escapeForCmdExe(cmd)}"`;
-    const escapedArgs = args.map((a) => `"${escapeForCmdExe(a)}"`);
-    return {
-        cmd: process.env['ComSpec'] ?? 'cmd.exe',
-        spawnArgs: ['/d', '/s', '/c', [escapedCmd, ...escapedArgs].join(' ')],
-        windowsVerbatimArguments: true,
-    };
-}
+import { resolveWrapSpawn } from '../win-spawn.js';
+export { resolveWrapSpawn };
 /**
  * Build the full ingest endpoint for a given client's base_url.
  * The CLI stores only the site base_url, so append the ingest path here.

package/dist/proxy/wrap-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"wrap-runner.js","sourceRoot":"","sources":["../../src/proxy/wrap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAsB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOnD;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC;SACL,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAE,8BAA8B;SACzD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAS,yBAAyB;SACrD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAQ,4BAA4B;AAC7D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,IAAc,EACd,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAE3B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS;QACxC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,sCAAsC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,oCAAoC,OAAO,gDAAgD,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,IAAc,EACd,QAA4B,EAC5B,OAAiB,EAAE;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,mHAAmH,CACpH,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE;YACxD,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,WAAW;YACX,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,GAAG,kBAAkB,IAAI,GAAG,EAAE;SAC1C,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACrC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,IAAI,OAAO,EAAE,CAAC;oBAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAC1C,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC,CAAC;YAEF,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3F,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE;oBACnC,KAAK,EAAE,SAAS;oBAChB,wBAAwB;oBACxB,GAAG,EAAE;wBACH,GAAG,OAAO,CAAC,GAAG;wBACd,gBAAgB,EAAE,KAAK,CAAC,OAAO;wBAC/B,UAAU,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE;wBAC5C,WAAW,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE;wBAC7C,QAAQ,EAAE,yBAAyB;wBACnC,aAAa,EAAE,QAAQ;wBACvB,mBAAmB,EAAE,QAAQ;wBAC7B,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,IAAI,QAAQ,YAAY,KAAK,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBACrF,wEAAwE;gBACxE,0EAA0E;gBAC1E,QAAQ,EAAE;qBACP,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;oBACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC/D,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;gBAC/B,CAAC,CAAC;qBACD,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,GAAU,EAAE,EAAE;gBACrC,IAAI,CAAC;oBACH,MAAM,QAAQ,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;wBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;gBACrF,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAmB,EAAE,EAAE;gBAC9C,IAAI,CAAC;oBACH,MAAM,QAAQ,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;wBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;gBACrF,CAAC;wBAAS,CAAC;oBACT,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC3D,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"wrap-runner.js","sourceRoot":"","sources":["../../src/proxy/wrap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAsB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAO5B;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,sCAAsC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,oCAAoC,OAAO,gDAAgD,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,IAAc,EACd,QAA4B,EAC5B,OAAiB,EAAE;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,mHAAmH,CACpH,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE;YACxD,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,WAAW;YACX,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,GAAG,kBAAkB,IAAI,GAAG,EAAE;SAC1C,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACrC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,IAAI,OAAO,EAAE,CAAC;oBAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAC1C,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC,CAAC;YAEF,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3F,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE;oBACnC,KAAK,EAAE,SAAS;oBAChB,wBAAwB;oBACxB,GAAG,EAAE;wBACH,GAAG,OAAO,CAAC,GAAG;wBACd,gBAAgB,EAAE,KAAK,CAAC,OAAO;wBAC/B,UAAU,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE;wBAC5C,WAAW,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE;wBAC7C,QAAQ,EAAE,yBAAyB;wBACnC,aAAa,EAAE,QAAQ;wBACvB,mBAAmB,EAAE,QAAQ;wBAC7B,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,IAAI,QAAQ,YAAY,KAAK,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBACrF,wEAAwE;gBACxE,0EAA0E;gBAC1E,QAAQ,EAAE;qBACP,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;oBACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC/D,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;gBAC/B,CAAC,CAAC;qBACD,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,GAAU,EAAE,EAAE;gBACrC,IAAI,CAAC;oBACH,MAAM,QAAQ,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;wBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;gBACrF,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAmB,EAAE,EAAE;gBAC9C,IAAI,CAAC;oBACH,MAAM,QAAQ,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;wBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;gBACrF,CAAC;wBAAS,CAAC;oBACT,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC3D,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/sessions/redact-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact-secrets.d.ts","sourceRoot":"","sources":["../../src/sessions/redact-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqCH,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWlD"}
+{"version":3,"file":"redact-secrets.d.ts","sourceRoot":"","sources":["../../src/sessions/redact-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAwCH,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWlD"}

package/dist/sessions/redact-secrets.js

@@ -24,6 +24,9 @@ const TOKEN_PATTERNS = [
     /sk_test_[0-9A-Za-z]{16,}/g, // Stripe test secret key
     /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, // JWT (three base64url segments)
     /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi, // Authorization: Bearer <token>
+    /\bBasic\s+[A-Za-z0-9+/=]{8,}/gi, // Authorization: Basic <base64 user:pass>
+    /https:\/\/hooks\.slack\.com\/services\/\S+/g, // Slack incoming webhook URL
+    /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\S+/g, // Discord webhook URL
     /\b[A-Fa-f0-9]{40,}\b/g, // long hex blobs (generic tokens / hashes)
     // PEM-formatted private key blocks (SSH/RSA/EC/OpenSSH/PGP/encrypted) — no assignment keyword
     // sits next to the base64 body, so ASSIGNMENT_QUOTED/BARE never catch these; a `cat ~/.ssh/id_rsa`

package/dist/sessions/redact-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact-secrets.js","sourceRoot":"","sources":["../../src/sessions/redact-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,uEAAuE;AACvE,MAAM,cAAc,GAAsB;IACxC,2BAA2B,EAAE,wBAAwB;IACrD,4BAA4B,EAAE,yBAAyB;IACvD,wBAAwB,EAAE,sCAAsC;IAChE,uBAAuB,EAAE,+BAA+B;IACxD,uBAAuB,EAAE,qBAAqB;IAC9C,+BAA+B,EAAE,0BAA0B;IAC3D,mBAAmB,EAAE,oBAAoB;IACzC,+BAA+B,EAAE,4CAA4C;IAC7E,wBAAwB,EAAE,iBAAiB;IAC3C,2BAA2B,EAAE,yBAAyB;IACtD,2BAA2B,EAAE,yBAAyB;IACtD,sDAAsD,EAAE,iCAAiC;IACzF,uCAAuC,EAAE,gCAAgC;IACzE,uBAAuB,EAAE,2CAA2C;IACpE,8FAA8F;IAC9F,mGAAmG;IACnG,iGAAiG;IACjG,uGAAuG;CACxG,CAAC;AAEF,6FAA6F;AAC7F,mGAAmG;AACnG,+FAA+F;AAC/F,oGAAoG;AACpG,qFAAqF;AACrF,yEAAyE;AACzE,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AACnH,MAAM,eAAe,GACnB,0GAA0G,CAAC;AAE7G,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,GAAG,IAAI;SACX,OAAO,CAAC,iBAAiB,EAAE,OAAO,QAAQ,IAAI,CAAC;SAC/C,OAAO,CAAC,eAAe,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"redact-secrets.js","sourceRoot":"","sources":["../../src/sessions/redact-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,uEAAuE;AACvE,MAAM,cAAc,GAAsB;IACxC,2BAA2B,EAAE,wBAAwB;IACrD,4BAA4B,EAAE,yBAAyB;IACvD,wBAAwB,EAAE,sCAAsC;IAChE,uBAAuB,EAAE,+BAA+B;IACxD,uBAAuB,EAAE,qBAAqB;IAC9C,+BAA+B,EAAE,0BAA0B;IAC3D,mBAAmB,EAAE,oBAAoB;IACzC,+BAA+B,EAAE,4CAA4C;IAC7E,wBAAwB,EAAE,iBAAiB;IAC3C,2BAA2B,EAAE,yBAAyB;IACtD,2BAA2B,EAAE,yBAAyB;IACtD,sDAAsD,EAAE,iCAAiC;IACzF,uCAAuC,EAAE,gCAAgC;IACzE,gCAAgC,EAAE,0CAA0C;IAC5E,6CAA6C,EAAE,6BAA6B;IAC5E,qDAAqD,EAAE,sBAAsB;IAC7E,uBAAuB,EAAE,2CAA2C;IACpE,8FAA8F;IAC9F,mGAAmG;IACnG,iGAAiG;IACjG,uGAAuG;CACxG,CAAC;AAEF,6FAA6F;AAC7F,mGAAmG;AACnG,+FAA+F;AAC/F,oGAAoG;AACpG,qFAAqF;AACrF,yEAAyE;AACzE,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AACnH,MAAM,eAAe,GACnB,0GAA0G,CAAC;AAE7G,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,GAAG,IAAI;SACX,OAAO,CAAC,iBAAiB,EAAE,OAAO,QAAQ,IAAI,CAAC;SAC/C,OAAO,CAAC,eAAe,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/skills/skill-scanner.d.ts

@@ -0,0 +1,55 @@
+/** Where a discovered SKILL.md was found, used both for display and for dedup priority
+ *  (see `dedupeSkillFiles`) — an authored copy is preferred over an installed runtime copy of
+ *  the same content. */
+export type SkillSourceKind = 'authored' | 'installed' | 'claude-code' | 'custom';
+export interface SkillRoot {
+    root: string;
+    sourceKind: SkillSourceKind;
+}
+export interface DiscoveredSkillFile {
+    filePath: string;
+    sourceKind: SkillSourceKind;
+    root: string;
+    mtimeMs: number;
+    contentHash: string;
+    skillName: string;
+    description?: string;
+}
+export interface SkillCandidate {
+    skillName: string;
+    contentHash: string;
+    /** The chosen canonical file to upload for this (skillName, contentHash) group. */
+    filePath: string;
+    sourceKind: SkillSourceKind;
+    root: string;
+    description?: string;
+    /** How many other on-disk copies (this file included) share this exact (skillName, contentHash). */
+    duplicateCount: number;
+}
+/**
+ * Extract `name:`/`description:` from a SKILL.md's YAML frontmatter block (`---\n...\n---` at
+ * the top of the file) with a small regex extractor rather than a YAML dependency — `js-yaml`
+ * is only an `overrides` pin in package.json (a transitive-dependency version pin), not a direct
+ * dependency, so parsing full YAML here would require adding one for a single flat key lookup.
+ * Values may be quoted or bare; quotes are stripped. Returns {} when there's no frontmatter block
+ * or it has no `name:`/`description:` field.
+ */
+export declare function parseSkillFrontmatter(content: string): {
+    name?: string;
+    description?: string;
+};
+/**
+ * Discover SKILL.md files across every root, reading and hashing each one. A file that can't be
+ * read (permissions, a race with deletion, etc.) is skipped with a warning via `onWarn` rather
+ * than aborting the whole scan — same convention as `map-claude-projects`' directory walk.
+ */
+export declare function findSkillFiles(roots: SkillRoot[], onWarn?: (message: string) => void): Promise<DiscoveredSkillFile[]>;
+/**
+ * Group discovered files by `(skillName, contentHash)` — not skill name alone, so a genuinely
+ * edited authored copy is never silently squashed by a stale installed duplicate of the same
+ * name — and pick one canonical file per group to actually upload. Within a group, prefer
+ * (in order): `sourceKind` priority (authored > claude-code > installed > custom), then newest
+ * `mtimeMs`, then path ascending for a deterministic tie-break.
+ */
+export declare function dedupeSkillFiles(files: DiscoveredSkillFile[]): SkillCandidate[];
+//# sourceMappingURL=skill-scanner.d.ts.map

package/dist/skills/skill-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-scanner.d.ts","sourceRoot":"","sources":["../../src/skills/skill-scanner.ts"],"names":[],"mappings":"AAIA;;wBAEwB;AACxB,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;AAElF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,cAAc,EAAE,MAAM,CAAC;CACxB;AAuBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB9F;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,SAAS,EAAE,EAClB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoChC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,cAAc,EAAE,CAqC/E"}